MiCA Licence Requirements: Who Needs a CASP Licence, Capital, Timelines and Passporting

What is a MiCA licence?

A MiCA licence is an authorisation as a crypto-asset service provider granted by the national competent authority of an EU member state under Article 63 of Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA), and it lets the holder serve clients in every member state from a single home base. Article 59(1) states the basic prohibition: a person may not provide crypto-asset services within the Union unless it is an authorised CASP or one of a short list of already regulated financial entities allowed to provide those services under Article 60.

The licence attaches to services, not to tokens. Article 3(1)(16) lists ten crypto-asset services, and the authorisation must specify which of them the firm may provide:

• Custody and administration of crypto-assets on behalf of clients.
• Operation of a trading platform for crypto-assets.
• Exchange of crypto-assets for funds, and exchange of crypto-assets for other crypto-assets.
• Execution of orders and reception and transmission of orders on behalf of clients.
• Placing of crypto-assets.
• Advice on crypto-assets and portfolio management on crypto-assets.
• Transfer services for crypto-assets on behalf of clients.

The Regulation has applied in full since 30 December 2024, with the stablecoin titles applying from 30 June 2024 (Article 149). Adding a service later is not automatic: under Article 59(8) the firm must ask its home authority to extend the authorisation, and that request runs through the same Article 63 assessment.

Who needs a MiCA licence, and who does not

Any legal person or undertaking that provides one of the ten services to clients in the EU needs a MiCA licence, unless it is a financial entity that can use the notification route or the client genuinely approached it on its own initiative. In practice that captures centralised exchanges, brokers, custodial wallet providers, crypto payment and transfer services, and firms advising on or managing crypto portfolios.

Three groups sit outside the standard licence:

• Regulated financial entities. Under Article 60, credit institutions, central securities depositories, investment firms, market operators, electronic money institutions, UCITS management companies and alternative investment fund managers may provide equivalent crypto-asset services after notifying their home regulator. A bank must notify at least 40 working days before providing the services for the first time.
• Reverse solicitation. Article 61 disapplies the authorisation requirement only where an EU client initiates the service at its own exclusive initiative. Any solicitation, by any means, defeats the exception, whatever the contract or disclaimer says.
• Token issuers. Issuing or offering tokens is governed by separate titles: white papers for ordinary crypto-assets under Title II, and authorisation regimes for asset-referenced tokens (ARTs) and e-money tokens (EMTs) under Titles III and IV. An issuer that also runs a trading venue or holds client assets needs a CASP licence as well.

Products that look like crypto but are legally something else fall outside MiCA altogether. Tokens that qualify as financial instruments stay under the MiFID framework, and event contracts raise their own questions, as our analysis of whether prediction markets are legal shows.

MiCA licence requirements: what the application must contain

The application is a full regulatory business case: Article 62(2) lists the information every applicant must submit to the competent authority of its home member state, and authorities may refuse to review a file that stays incomplete.

The core contents are:

• Identity and form. Legal and commercial names, legal entity identifier, website, physical address, legal form and articles of association.
• Programme of operations. The services the firm intends to provide, including where and how they will be marketed.
• Prudential proof. Evidence that the Article 67 capital requirement is met.
• Governance and people. A description of governance arrangements and proof that members of the management body are of sufficiently good repute and have the knowledge, skills and experience to run the firm.
• Owners. The identity of shareholders with qualifying holdings, the size of those holdings and proof of their good repute.
• Controls. Internal control mechanisms and policies to manage risks, including money laundering and terrorist financing risks, and a business continuity plan.
• Technology and assets. Technical documentation of ICT systems and security, procedures for segregating client crypto-assets and funds, complaints handling and, where relevant, custody and trading platform rules.

Substance is the hardest test. Article 59(2) requires an authorised CASP to have its registered office in a member state where it carries out at least part of its services, its place of effective management in the Union, and at least one director resident in the Union. ESMA's supervisory briefing on the authorisation of CASPs (31 January 2025) goes further: at least one executive board member should be resident in the member state granting authorisation, or in a directly neighbouring country for a small member state, and available for in-person engagement with the authority on no more than two business days' notice. The briefing also tells authorities to scrutinise outsourcing, particularly to third countries and within groups.

Our sister publication Global Law Experts makes the same point in its practical guide to operating after MiCA's grandfathering cut-off, identifying a governance model "that exists only on paper", with key functions outsourced outside the EU, as a frequent deficiency in applications.

Minimum capital: the three MiCA classes

MiCA sets minimum capital by the riskiest service a firm provides: EUR 50,000, EUR 125,000 or EUR 150,000, or one quarter of the previous year's fixed overheads if that is higher. The amounts come from Annex IV to MiCA, and Article 67 requires the safeguards to be in place "at all times".

Class	Services that put a firm in the class	Permanent minimum capital
Class 1	Execution of orders, placing, transfer services, reception and transmission of orders, advice, portfolio management	EUR 50,000
Class 2	Any class 1 service plus custody and administration, exchange for funds or exchange for other crypto-assets	EUR 125,000
Class 3	Any class 2 service plus operation of a trading platform	EUR 150,000
Issuers of ARTs (for comparison)	Authorised issuers of asset-referenced tokens under Article 35	Highest of EUR 350,000, 2% of the average reserve of assets, or a quarter of fixed overheads

The fixed overheads test usually bites for any firm of scale. A new firm without a year of trading uses the projected fixed overheads in the financial plan it filed with its application (Article 67(2)), so optimistic projections have a direct capital cost. The Global Law Experts checklist notes that MiCA allows the safeguard to be met through own funds, an insurance policy or a comparable guarantee, subject to conditions, which can matter for smaller class 1 advisers.

Searchers often ask about "MiCA licence cost". The statutory figure is the capital above, which is not a fee: it remains the firm's money. Application fees, supervisory levies, local staff, audit and legal costs vary by member state and are not set by MiCA.

How long does it take to get a MiCA licence?

On paper a complete application must be decided within 40 working days, but the clock only starts once the authority accepts the file as complete, so real timetables depend on the quality of the first submission. Article 63 of MiCA sets the stages.

Stage	Statutory time limit	MiCA provision
Acknowledgement of receipt	Within 5 working days of receipt	Article 63(1)
Completeness check	Within 25 working days of receipt; authority sets a deadline for missing information	Article 63(2)
Assessment and reasoned decision	Within 40 working days of receipt of a complete application	Article 63(9)
Notification of the decision	Within 5 working days of the decision	Article 63(9)
Cross-border start after passport notification	From receipt of confirmation, or at the latest the 15th calendar day after notifying	Article 65(4)

A practical sequence for an applicant looks like this:

1. Map each product against the ten services and fix the class, and therefore the capital.
2. Choose a home member state and incorporate an EU entity with genuine local management.
3. Appoint a management body and identify qualifying shareholders, with fit and proper evidence for each.
4. Draft the programme of operations, financial plan, governance, AML, ICT, custody, conflicts and complaints policies.
5. Engage the authority before filing, then submit under Article 62.
6. Answer completeness and assessment questions quickly; delays here are the main driver of elapsed time.
7. On authorisation, notify the home authority of the states you intend to serve under Article 65.

Authorities must consult each other where the applicant belongs to a group with regulated entities elsewhere in the EU (Article 63(5)), and may consult anti-money laundering authorities and financial intelligence units (Article 63(6)). They must refuse where the management body or shareholders fail the repute tests, or where close links to a third country prevent effective supervision (Article 63(8) and (10)). Firms needing help with the filing can find licensing specialists in our directory.

Passporting a MiCA licence across the EU

A MiCA licence is a passport: Article 59(7) allows an authorised CASP to serve clients throughout the Union, through a branch or on a cross-border basis, without any physical presence in the host state. The procedure in Article 65 is a notification, not a second application. The firm tells its home authority which member states and services it intends to cover, the starting date and any non-MiCA activities. The home authority forwards that information to the host states, ESMA and the European Banking Authority within 10 working days, and the firm may start in the host state when told the communication has been made, or at the latest on the 15th calendar day after notifying.

The passport only exists once the licence does. ESMA's statement of 17 December 2024 reminded firms that without MiCA authorisation they would not benefit from passporting rights during the transitional period, which is why firms with clients in states with short grandfathering windows rushed to be authorised early. The register shows how wide passports now run: large platforms such as Bitpanda and Bybit list almost every EU and EEA state in their service notifications.

The end of grandfathering: transitional periods by member state

MiCA's transitional regime is over everywhere: Article 143(3) let firms already operating lawfully under national law before 30 December 2024 continue until 1 July 2026 at the latest, and many member states chose shorter periods. ESMA's list of grandfathering periods decided by member states records the choices below, counted from 30 December 2024. ESMA notes that some periods were communicated by national authorities as expectations and may not all have been written into national law.

Grandfathering period	Member states (ESMA list)	Ran until
6 months	Finland, Hungary, Latvia, Netherlands, Poland, Slovenia	Mid-2025
9 months	Sweden	Autumn 2025
12 months	Austria, Germany, Ireland, Lithuania, Slovakia; Norway (EEA)	End of 2025
18 months (maximum)	Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, France, Greece, Italy, Luxembourg, Malta, Portugal, Romania, Spain; Iceland and Liechtenstein (EEA)	1 July 2026

Several of the 18-month states attached conditions. Italy required entities on its anti-money laundering register for virtual asset providers to apply for MiCA authorisation by 30 December 2025 to keep the benefit; Czechia set a 31 July 2025 application deadline; Denmark required applications before 30 December 2024; and Bulgaria required its registered providers to apply by 8 October 2025.

ESMA hardened its line as the deadline approached. In a statement of 4 December 2025 it told authorities to treat "last minute" applications with considerable caution, even if that meant an applicant had to wind down while its file was assessed, and expected unauthorised CASPs to have orderly wind-down plans. Its statement of 17 April 2026 required those plans to be implemented by 1 July 2026 and told authorised CASPs to onboard migrating clients with robust anti-money laundering checks. Firms that missed the window face penalties: under Article 111(3), member states must be able to fine legal persons at least EUR 5 million or 5% of annual turnover for breaches of the CASP rules.

ESMA's role: convergence, peer reviews and a push for direct supervision

ESMA does not grant MiCA licences today, but it shapes how national authorities grant them, keeps the register and is pressing for more power. Its main tools so far have been statements, the January 2025 supervisory briefing, opinions and peer reviews.

The clearest signal came in July 2025, when ESMA published a fast-track peer review of a CASP authorisation by the Malta Financial Services Authority. It rated Malta fully meeting expectations on supervisory settings and resources, largely meeting expectations on supervisory review, and only partially meeting expectations on the authorisation process, finding that some material issues were not fully resolved when the licence was granted. ESMA asked all authorities to focus on business growth, conflicts of interest, governance and intragroup arrangements, ICT architecture, Web3 and decentralised products, and the promotion of unregulated services.

The policy agenda is now moving towards centralisation. On 4 December 2025 the European Commission proposed a market integration and supervision package that, as ESMA's press release welcoming it explains, would transfer direct supervision of crypto-asset service providers, along with certain significant infrastructures, to EU level; the proposal still needs the agreement of the European Parliament and the Council. On 30 September 2026 ESMA's response to the Commission's MiCA review consultation asked for stricter rules on crypto marketing by influencers and third parties, proportionate rules for staking, lending and borrowing, a new regulated service for access to DeFi protocols, binding ESMA opinions on token classification, and reinforced powers against third-country firms that solicit EU investors without authorisation. The marketing point echoes concerns about crypto sponsorship deals in football and the complaints over financial scam advertising on large platforms. ESMA has also announced a new supervisory priority on digital innovation from 2027, initially covering AI and tokenisation, which sits alongside obligations such as those in the EU AI Act timeline.

Stablecoins under MiCA: ARTs, EMTs and the October 2026 opinion

Stablecoins are regulated at the issuer level under MiCA, and since 8 October 2026 ESMA expects licensed CASPs to stop offering any service in tokens whose issuers have not complied. An e-money token, pegged to a single official currency, may only be offered to the public or admitted to trading in the EU by a credit institution or an electronic money institution that has notified and published a white paper (Article 48). An asset-referenced token issuer needs authorisation under Article 21, or must be a credit institution, and must hold the own funds shown in the capital table above.

ESMA's opinion on services related to non-MiCA-compliant stablecoins says CASPs should cease providing services in such tokens to EU clients across the full range of MiCA services, from trading and exchange to custody, transfers and portfolio management. National authorities should require remediation of existing exposures as soon as possible and no later than three months after publication, with any continuing activity limited to liquidation, conversion, withdrawal, transfer or safekeeping. The full opinion grounds this in the Article 66(1) duty to act honestly, fairly and professionally in clients' best interests.

The register shows how narrow the compliant universe is. The EMT file of the interim register, updated on 7 October 2026, has 50 entries from 25 issuers, with the Netherlands and France the most common home states, while the file for authorised ART issuers is empty.

The travel rule and anti-money laundering: TFR, AMLR and AMLA

A MiCA licence comes with a full anti-money laundering rulebook that is still tightening: the crypto travel rule has applied since 30 December 2024, the new Anti-Money Laundering Regulation applies from 10 July 2027, and the new EU authority will start choosing firms for direct supervision by 1 July 2027.

• Transfer of Funds Regulation. Regulation (EU) 2023/1113 requires the originator's CASP to send the originator's name, distributed ledger address and account details with every transfer, and the beneficiary's CASP to receive them. For transfers to self-hosted addresses the CASP must collect and hold the information, and for transfers above EUR 1,000 it must take adequate measures to assess whether the address is owned or controlled by its own client.
• Anti-Money Laundering Regulation. Regulation (EU) 2024/1624 applies from 10 July 2027. It requires CASPs to apply customer due diligence to occasional transactions of at least EUR 1,000 and prohibits anonymous crypto-asset accounts and accounts that allow anonymisation, including through anonymity-enhancing coins.
• AMLA. Under Regulation (EU) 2024/1620, the Anti-Money Laundering Authority must start its first selection of high-risk credit and financial institutions, a category that includes CASPs, by 1 July 2027, and begins direct supervision six months after publishing the list. The Regulation aims its direct supervision at high-risk entities operating in at least six member states.

For a passported exchange, AMLA selection is a realistic prospect. The sentencing in the Nodus Bank fraud and sanctions case is a reminder of how financial crime exposure turns into personal liability, and firms building their controls can find economic crime advisers in our directory.

MiCA license list: where firms are getting licensed

The interim MiCA register is the authoritative MiCA license list, and it shows Germany well ahead on numbers, with Malta, Cyprus, Luxembourg, Ireland and Austria favoured by large international platforms. ESMA's MiCA page publishes the register as downloadable files; the CASP file updated on 7 October 2026 contains 370 entries for 365 legal entities, two of them since withdrawn. It covers both newly licensed CASPs and banks and investment firms offering crypto services, which helps explain Germany's lead.

Home state	Live CASP entries (7 October 2026)	Examples from the register
Germany	103	Boerse Stuttgart Digital Custody GmbH; Trade Republic Bank GmbH; Commerzbank AG
France	36	Circle Internet Financial Europe SAS; Societe Generale Forge; Blocknodes SAS (SwissBorg)
Netherlands	28	Bitvavo B.V.; MoonPay Europe B.V.
Cyprus	24	eToro (Europe) Ltd; Revolut Digital Assets (Europe) Ltd
Malta	23	OKX Europe Limited; Foris DAX MT Limited (Crypto.com); Gemini Intergalactic EU Ltd
Spain	15	BBVA; CaixaBank; Bit2Me
Luxembourg	13	Coinbase Luxembourg S.A.; Bitstamp Europe S.A.; Ripple Payments Europe S.A.
Ireland	12	Payward entities trading as Kraken
Austria	11	Bitpanda GmbH; Bybit EU GmbH
Lithuania	6	Robinhood Europe UAB

Czechia, Latvia and Liechtenstein have 12 entries each and Italy nine. Hungary, Poland and Romania have none. The register also lists 173 non-compliant entities flagged by authorities for providing services in breach of Article 59 or 61, 164 of them notified by Italy.

Why these choices? Group structure matters more than marketing claims: banks and investment firms with an existing licence tend to stay at home, while groups building a new EU entity weigh supervisory experience, language and the authority's processing record. Global Law Experts' comparison of Malta and other EU jurisdictions as a MiCA home member state notes that Malta and Ireland are the only member states with English as an official language and that a Maltese base means incorporating there "with the substance that goes with it". The ESMA peer review is the counterweight: speed of authorisation is not a reason ESMA accepts. Advisers in Malta, Luxembourg, Ireland, Germany and Cyprus are listed in our directory.

What UK and US crypto firms must do

A firm outside the EU cannot use its home licence in the EU: to serve EU clients it needs an EU subsidiary authorised under MiCA, with real local management, or it must stay strictly within reverse solicitation.

The reverse solicitation exception is narrow by design. ESMA's guidelines on reverse solicitation treat any promotion or advertising aimed at the EU as solicitation and read the permission to offer crypto-assets "of the same type" narrowly. Its April 2026 statement added that the prohibition applies in a business-to-business context too, and that CASPs must not route EU clients to unauthorised third-country group entities through outsourcing or delegation, notably of custody. The Global Law Experts guide to reverse solicitation under MiCA sets out the evidence a firm would need to rely on the exception, from referral paths to contemporaneous onboarding records, and concludes that it is "a narrow exception, not a business model".

US groups have mostly taken the subsidiary route: the register lists EU entities of Coinbase in Luxembourg, Kraken's parent Payward in Ireland, Gemini in Malta, Robinhood in Lithuania and Circle in France. UK firms face the same choice, with the added complication that the UK is building a separate regime. MiCA authorisation does not give access to UK customers, and FCA authorisation will not give access to the EU, as our analysis of the FCA's cryptoasset regime and its treatment of overseas firms explains. A group serving both markets will need two regulated entities and two sets of policies.

Common mistakes and when to bring in an adviser

The most expensive mistakes are structural, and they are usually made before the application is filed. ESMA's statements, the Malta peer review and the supervisory briefing point to the same recurring failures:

• A shell EU entity. Directors who are not resident, decisions taken outside the EU, or key functions outsourced back to a non-EU parent.
• Wrong service mapping. Treating an exchange or staking product as a lower class service, which understates capital and leaves services unauthorised.
• Relying on reverse solicitation while running EU-language marketing, affiliates or influencers.
• Buying a licensed shell. A licence belongs to the authorised entity and its approved owners and managers; a change of qualifying holders needs fresh repute assessment.
• Ignoring the stablecoin opinion, leaving non-compliant tokens listed beyond the three-month remediation window.
• Treating the travel rule and AMLR as afterthoughts, when AMLA selection from 2027 will test them directly.

A specialist adviser earns their fee on the home state decision, the service map and capital calculation, the governance design and the dialogue with the authority. Corporate INTL's directory lists banking and finance lawyers and regulatory specialists who handle MiCA authorisations. Meeting the MiCA licence requirements is now the price of serving EU clients at all.

Frequently asked questions

What is a MiCA license?

It is an authorisation as a crypto-asset service provider granted by a national competent authority under Article 63 of MiCA. It specifies which of the ten crypto-asset services the firm may provide and lets it serve clients across the EU and EEA through passporting, without a separate licence in each member state.

What are the MiCA requirements for a CASP?

An EU registered office, effective management in the Union and at least one EU-resident director; minimum capital of EUR 50,000, 125,000 or 150,000 depending on services; fit and proper managers and shareholders; AML, ICT, custody and complaints procedures; and the full Article 62 application file.

How long does it take to get a MiCA license?

MiCA gives the authority 25 working days to check completeness and 40 working days from a complete file to decide, plus five working days to notify. In practice the total depends on how quickly the applicant answers questions, because the 40-day clock only starts once the file is complete.

How much capital does a MiCA licence need?

Class 1 firms, such as advisers and brokers, need EUR 50,000; class 2 firms offering custody or exchange need EUR 125,000; class 3 firms operating a trading platform need EUR 150,000. If one quarter of the previous year's fixed overheads is higher, that amount applies instead.

When did the MiCA transitional period end?

The longest transitional period ended on 1 July 2026. Many states set shorter periods: six months in Finland, Hungary, Latvia, the Netherlands, Poland and Slovenia, nine months in Sweden and 12 months in Austria, Germany, Ireland, Lithuania and Slovakia, according to ESMA's list.

Can a MiCA licence be used in every EU country?

Yes. An authorised CASP notifies its home authority of the states and services it wants to cover. The home authority passes this on within 10 working days, and the firm can start no later than the 15th calendar day after notifying, without needing a physical presence in the host state.

Can a UK or US crypto firm serve EU clients without a MiCA licence?

Only where an EU client approaches it entirely on its own initiative. Any EU-directed promotion defeats this reverse solicitation exception, and ESMA says it applies to business clients too. In practice UK and US groups serve EU clients through an authorised EU subsidiary.

Is Coinbase MiCA compliant?

ESMA's interim register lists Coinbase Luxembourg S.A. as an authorised CASP, with an authorisation dated 20 June 2025. EU clients should check that the entity named in their contract is the authorised one, because MiCA protections attach to that legal entity, not to the wider group.

What happens to stablecoins that are not MiCA compliant?

On 8 October 2026 ESMA said licensed CASPs should stop providing services in non-compliant ARTs and EMTs to EU clients. Authorities should require existing exposures to be remediated within three months, with only liquidation, conversion, withdrawal, transfer or safekeeping allowed meanwhile.

Sources

1. Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA), EUR-Lex
2. Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets, EUR-Lex
3. Regulation (EU) 2024/1624 (Anti-Money Laundering Regulation), EUR-Lex
4. Regulation (EU) 2024/1620 establishing the Anti-Money Laundering Authority, EUR-Lex
5. ESMA: Markets in Crypto-Assets Regulation and interim MiCA register (last update 7 October 2026)
6. ESMA: List of grandfathering periods decided by member states under Article 143 MiCA
7. ESMA: Statement on MiCA transitional measures (17 December 2024)
8. ESMA: Statement on MiCA transitional measures (4 December 2025)
9. ESMA: Statement on the end of transitional periods under MiCA (17 April 2026)
10. ESMA: Supervisory briefing on the authorisation of CASPs under MiCA (31 January 2025)
11. ESMA: Fast-track peer review on a CASP authorisation and supervision in Malta (10 July 2025)
12. ESMA: Final report on guidelines on reverse solicitation under MiCA (17 December 2024)
13. ESMA: ESMA welcomes Commission's ambitious proposal on market integration (4 December 2025)
14. ESMA: New supervisory priority on digital innovation from 2027 (23 September 2026)
15. ESMA: ESMA calls for changes to make MiCA clearer, safer and ready for emerging services (30 September 2026)
16. ESMA: Supervisory expectations on services related to unauthorised stablecoins (8 October 2026)
17. ESMA: Opinion on crypto-asset services in relation to non-MiCA-compliant ARTs and EMTs (8 October 2026)
18. Global Law Experts: The EU's crypto licence wall, operating after MiCA's grandfathering cut-off (August 2026)
19. Global Law Experts: Token issuance in Malta vs other EU jurisdictions, choosing your MiCA home member state (October 2026)
20. Global Law Experts: Reverse solicitation under MiCA in Poland (September 2026)

About this article

This analysis was researched and written by The Corporate INTL Newsroom, which covers cross-border legal, regulatory and business developments for lawyers, professional advisers and financiers in over 150 jurisdictions. It has been checked against the text of MiCA, the Transfer of Funds Regulation, the Anti-Money Laundering Regulation and the AMLA Regulation, ESMA's statements, supervisory briefing, peer review, guidelines and opinions, ESMA's interim MiCA register files as updated on 7 October 2026, and guides published by our sister publication Global Law Experts. Register counts are a snapshot and change weekly; national application fees and processing practice vary by member state and are not covered. This article is general information, not legal or regulatory advice; for advice on a specific matter, consult a qualified adviser. Last reviewed 9 October 2026. For more analysis like this, visit the Corporate INTL newsroom or subscribe to Corporate INTL.